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Abstract — In this paper, I present a method to solve a node 
discovery problem in a networked organization. Covert nodes 
refer to the nodes which are not observable directly. They affect 
social interactions, but do not appear in the surveillance logs 
which record the participants of the social interactions. Discov- 
ering the covert nodes is defined as identifying the suspicious 
logs where the covert nodes would appear if the covert nodes 
became overt. A mathematical model is developed for the maximal 
likelihood estimation of the network behind the social interactions 
and for the identification of the suspicious logs. Precision, recall, 
and F measure characteristics are demonstrated with the dataset 
generated from a real organization and the computationally 
synthesized datasets. The performance is close to the theoretical 
limit for any covert nodes in the networks of any topologies and 
sizes if the ratio of the number of observation to the number of 
possible communication patterns is large. 

Index Terms — Anomaly detection, Covert node, Maximal like- 
lihood estimation, Node discovery, Social network. 

I. Introduction 

Covert nodes in a networked organization refer to persons 
who affect social interactions (communications among the 
nodes and resulting collaborative activities), but do not appear 
in the surveillance logs which record the participants of the 
social interactions. They are not observable directly. Discov- 
ering the covert nodes is defined as identifying the suspicious 
surveillance logs where the covert nodes would appear if the 
covert nodes became overt. This problem is called a node 
discovery problem. 

Where do we encounter such a problem? Globally net- 
worked clandestine organizations such as terrorists, criminals, 
or drug smugglers are great threat to the civilized societies. 
Terrorism attacks cause great economic, social and environ- 
mental damage. Active non-routine responses to the attacks are 
necessary as well as the damage recovery management. The 
short-term target of the responses is the arrest of the perpetra- 
tors. The long-term target of the responses is identifying and 
dismantling the covert organizational foundation which raises, 
encourages, and helps the perpetrators. The threat will be miti- 
gated and eliminated by discovering covert leaders and critical 
conspirators of the clandestine organizations. The difficulty of 
such discovery lies in the limited capability of surveillance. 
Information on the leaders and critical conspirators are missing 
because it is usually hidden by the organization intentionally. 

In this paper, I present a method to solve the node dis- 
covery problem. The method infers the network topology and 
probability parameters behind the social interactions (by use 
of the maximal likelihood estimation), applies an anomaly 
detection technique to the surveillance logs, and identifies 



the suspicious surveillance logs. (TTTJ presents the method. (TV] 
introduces the dataset generated from a real organization 
and the computationally synthesized datasets for performance 
tests. [V] demonstrates the precision, recall, and F measure 
characteristics with the datasets. 

II. Related Work 

The social network analysis is a study of social structures 
made of nodes which are linked by one or more specific types 
of relationship. Examples of the relationship are influence 
transmission in communication, or presence of trust in col- 
laboration. Studies in complex networks 0, ll24l . 0, WWW 
search and analysis 0, 0, and machine learning of latent 
variables lETl . li22l are major related research topics. 

Research interests have been moving from describing orga- 
nizational nature to discovering unknown phenomena. A link 
discovery predicts the existence of an unknown link between 
two nodes from the information on the known attributes of the 
nodes and the known links 0, 0, ll23l . The link discovery 
techniques are combined with domain- specific heuristics. The 
collaboration between scientists can be predicted from the 
published co-authorship [12]. The friendship between people is 
inferred from the information available on their web pages El . 
Discovery of a network structure 1(181 , |[T6l , ifTTl and detection 
of an anomaly in a network |[20l are also relevant related 
research topics. 

A node discovery predicts the existence of an unknown 
node around the known nodes from the information on the 
collective behavior of the network. Related works in the node 
discovery is limited. Heuristic method for node discovery is 
proposed in lfT3l . The method applies clustering algorithm 
ll25l . to the nodes in a network, and detects the node which 
inter-connects clusters at the border of a cluster in clustered 
networks. The method is applied to analyze the covert social 
network foundation behind the terrorism disasters |[T4l . 



III. Method 



A. Observation 



A node and a link in a social network are a person 
and a relationship resulting in influence transmission between 
persons. The symbols rij (j = 0, 1, • • • ) represent the nodes. 
Some nodes are overt (observable), but the others are covert 
(unobservable). O denote a set of the whole overt nodes 
{no,ni,-- - , njv-i}. Us cardinality is N = \0\. C = O 
denotes a set of the whole covert nodes {n^v, wjv+i? ' ' ' }• The 
symbol Si (0 < i < D) represent an individual communication 
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pattern (and a resulting collaborative activity) among the 
persons. It is a set of nodes, Si E OnC. The unobservability 
of the covert nodes does not affect the communication pattern. 
For example, the members of a communication pattern are 
those who join an online community. 

An observation di in surveillance logs is a set of the overt 
nodes in a communication pattern Si. It is given by eq.©. The 
number of data is D. 



di = Si D O (0 < i < D). 



(1) 



{di} denotes the observation dataset. Note that neither an 
individual node nor a single link can be observed directly, but 
a group of nodes can be observed as a communication pattern. 
{di} can be expressed by a 2-dimensional D x N matrix of 
binary variables d. The presence or absence of the node rij in 
the data di is indicated by the elements in eq.©. 



dij = { J 



if rij G di 



(0<i<D, 0<j<N). (2) 



otherwise 
B. Maximal Likelihood Estimator Network 

A parametric form is defined to describe the network 
topology and the influence transmission over the network. The 
influence transmission governs the possible communication 
patterns {Si} which result in the observation dataset {di}. The 
probability where the influence transmits from an initiating 
node rij to a responder node rik is r^. The influence transmits 
to multiple responders independently in parallel. It is similar 
to the degree of collaboration probability in trust modeling 
ifTTTl . The constraints are < rjk and Y^k^j r 3 k — 1- The 
quantity fj is the probability where the node rij becomes an 
initiator. The constraints are < fj and Yj^ 1 fj = ^- These 
parameters are defined for the whole nodes in a social network 
(both the nodes in O and C). 

A single symbol represent both of the parameters rjk 
and fj for the nodes in O. is the target variable, the 
value of which needs to be inferred from the observation 
dataset. The logarithmic likelihood function (U is defined by 
eq.©. The quantity p({di}\6) denote the probability where 
the observation dataset {di} realizes under a given 0. 



L(0)=log(p({d i }\0)). 



(3) 



The individual observations are assumed to be independent, 
eq.© becomes eq.©. 

D-l D-l 

L{6) = log( J] p(di\9)) = Y, log(p(di|*)). (4) 

2=0 2=0 

The quantity q^j k in eq.© is the probability where the 
presence or absence of the node as a responder to the 
stimulating node rij coincides with the observation di. 



Qi\jk 



f r jk 



if dik = 1 for given i and j 
otherwise 



(5) 



eq.© is equivalent to eq.© since the value of dik is either 
or 1. 

Qi\jk = dikTjk + (1 - d ik ) (I ~ rjk)' (6) 



The probability p({di}\6) in eq.© is expressed by eq.©. 
The operator A means logical AND. 



N-l 



p(di\0) = d ijfj II qi \i k ' 

j=0 0<k<N A k^j 



(J) 



The logarithmic likelihood function takes an explicit for- 
mula in eq.©. The case k = j in multiplication (Yl k ) is 
included since dj k = dik always holds. 

D-l N-l N-l 

L(0) = lQ g(IZ d ^fo Hi 1 ' d ^ + (2*fc - l)r jk }). 

i=0 j=0 k=0 

The maximal likelihood estimator is obtained by solving 
eq.©. 

= argmaxL(0). (9) 


A simple incremental optimization technique (hill climbing 
method) is employed to solve eq.©. Simulated annealing 
method |8] can be employed to strengthen the search ability 
and to avoid sub-optimal solutions. These methods search more 
optimal parameter values around the present values and update 
them as in eq.([TQl) until the values converge. 

T^f?+ + ±t jk (°^ <iv )- (10) 

The update Ar nm and Af n should be in the direction of the 
maximal ascend of the likelihood function. It is indicated by 
the multiplication of the derivatives and the updates in eq.([TT1). 



N-l 



N-l 



AL(9)= £ 



9m Ar +V aL W 

n=0 



dr n 



E 



dfn 



A/„. (11) 



Individual derivatives in eq.dTTt are calculated by eq.(fl2l). 
and eq.JOl). 



dL(0) 

dr nrn 



D-l 



[fndin(2d irn — 1) II {1 — ^k + (2d, 



"ik 



2 = 

N-l N-l 



ky^m 



-l)r„ fc } -j- ^ dijfj H {1 - dik + (2difc - 1)^}]. (12) 



dL{9) 

dfn 



j=0 fe=0 
D-l N-l 

-- ^2 \- din n ^ ~ dik + ( 2dik ~ i ) r ^} 

2 = k = 

N-l N-l 

+ di ofo Hi 1 ' d *k + (2^fc - l)r jk }}- (13) 

3=0 A;=0 

C. Node Discovery - Anomaly Detection 

Suspiciousness of the observation data di is evaluated by 
eq. ([T4b . Suspiciousness means the likeliness where the covert 
node would appear in the data if it became overt. Larger value 
means more suspicious data. 

s(di) = — (14) 
P(di\0) 
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Fig. 1. Network model (A) representing global mujahedin (Jihad fighters) 
organization tl9l . The model consists of 107 nodes, and 4 regional sub- 
networks. The sub-networks represent Central Staffs (CS), Core Arabs (CA), 
Maghreb Arabs (MA), and Southeast Asians (SA). The node ncsio, which 
is indicated by a red circle, is believed to be the founder of the organization. 



Ranking of the observation data can be calculated from the 
value of eq.([T4b. The i-th most suspicious data is given by d a ^ 
in eq.([T5b. Suspiciousness s(d a ^) is larger than s(d a ^\) for 
any i < i' . 

a(i) = arg max s(d m ) (1 < i < D). (15) 

m^<j{n) for v n<i 



IV. Test Dataset 



A. Network Model 



Two classes of network models are employed to generate 
communication test dataset. The first class is a real organiza- 
tion. The second class is a mathematical model having several 
adjustable parameters. 

The network model (A) in FigQ] represents a real orga- 
nization. It is a global mujahedin (Jihad fighters) organi- 
zation which was analyzed in lfT9l . The model consists of 
107 persons and 4 regional sub-networks. The sub-networks 
represent Central Staffs (CS), Core Arabs (CA) from the 
Arabian Peninsula countries and Egypt, Maghreb Arabs (MA) 
from the North African countries, and Southeast Asians (SA). 
The organization has a relatively large Gini coefficient of the 
nodal degree, 0.35, and a relatively large average clustering 
coefficient, 0.54, l24ll . In economics, the Gini coefficient is 
a measure of inequality of income distribution or of wealth 
distribution. A larger Gini coefficient indicates lower equality. 
The values mean that the organization possesses hubs and a 
group structure. 

The node ncsio (indicated by a red circle in FigQ]) is a 
hub having relatively large nodal degree (if(ncsio) = 8). It 
is believed to be the founder of the organization, and said to 
be the covert leader who provides operational commanders in 
regional sub-networks with financial support in many terrorism 
attacks including 9/11 in 2001. His whereabouts are not known 
despite many efforts in investigation and capture. 



Fig. 2. Network model (C) consisting of 201 nodes and G = 8 groups. 
The group contrast parameter in eq.(fl6t is rj{G — 1) = 400. The node ni, 
which is indicated by a red circle, is the largest hub whose nodal degree is 
K(m) = 23. 



The model (A) provides with the practical implication 
of solving the node discovery problem. But mathematical 
model is more suitable than the real organization to study 
the extensive quantitative characteristics of the method. Here, 
Barabasi- Albert model with a group structure is used as a 
generalization of hubs and group structure in the model (A). 
The Barabasi- Albert model grows with preferential attachment. 
The probability where a newly coming node rik connects a link 
to an existing node nj is proportional to the nodal degree of rij 
(p(k — > j) oc K{rij)). The occurrence frequency of the nodal 
degree tends to be scale-free (f(K) oc K a ). In the Barabasi- 
Albert model with a group structure, every node rij is assigned 
a pre-determined group attribute c(rij) to which it belongs. The 
number of groups is G. The probability p(k — > j) is modified 
to eq.([T6l). Group contrast parameter r) is introduced. Links 
between the groups appear less frequently as r) increases. The 
initial links between the groups are connected at random before 
growth by preferential attachment starts. 



p(k -> j) oc 



rj(G - l)K(rij) if c(rij) = c(n k ) 
K(rtj) otherwise 



(16) 



The network models (B), (C), and (D) are examples where 
the number of nodes is 201 and G = 1, 8, and 201. The model 
(B) results in the conventional Barabasi- Albert model. The 
model (C) is shown in Figj2] The model (D) results in Erdos- 
Renyi model (6) which is configured by random connection 
between nodes. 

B. Communication Model 

The dataset for performance tests is generated from the 
network models in IIV-AI in the 2 steps below. 

In the first step, the communication patterns {Si} are 
generated D times according to the influence transmission 
under the true value of 0. A pattern includes both an initiator 
node rij and multiple responder nodes n^. An example is #o = 
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{ncsi, ^CS2, ^CS4, ^CS5, ^CS6, ^CS7, ^CSIO, ™CS11> ™CS12} 

for the model (A) in FigQ] 

In the second step, the observation dataset {di} is generated 
by deleting the covert nodes in C from the patterns {Si}. 
The example So results in the observation do = So H C = 
{rccsi, rccs2, n C s4, n C s5, ^cse, ^CS7, ^csn, ^csi2} if the ex- 
perimental condition is that C = {ncsio}- 

The covert node in C may appear multiple times in the 
communication patterns {Si}. The number of the target obser- 
vation data to identify is given 

by A = Ei=o B(di ± Si). 

The function B (s) returns 1 if the statement s is true and 
otherwise. A few conditions are assumed in the performance 
evaluation in [V] for simplicity. At first, the probability fj does 
not depend on the nodes (fj = l/\OUC\). Second, the value of 
the probability is either or 1 . The number of the possible 
communication patterns is bounded (less than or equal to the 
number of nodes N). Finally, the influence transmission is bi- 
directional (rjk = rkj). 

V. Performance Evaluation 

A. Performance Measure 

Precision, recall, and F measure are used as a measure 
of the performance. In information retrieval (such as search, 
document classification, and query classification), the precision 
p is used as evaluation criteria, which is the fraction of the 
number of relevant data to the number of the all data retrieved 
by search. The recall r is the fraction of the number of the 
data retrieved by search to the number of the all relevant data. 
The relevant data refers to the data where di ^ Si. They are 
given by eq.([T7t and eq.([T8t They are functions of the number 
of the retrieved data D r . It can take the value from 1 to D. 
The data is retrieved in the order of d a ^, d a ( 2 ), to d a ^ Dr y 



r(D r ) 



D T 



Yh=1 B (d*(i) + Sa(i)) 



D t 



(17) 



(18) 



The F measure F is the harmonic mean of the precision 
and recall [ 10 1 . It is given by eq.([T9l). 



F(D r ) 



1 



2p(D r )r(D r ) 
p(D r ) + r(D r ) 



(19) 



2\p(D r ) 1 r{D Y )> 

The precision, recall, and F measure range from to 1 . All 
the measures take larger values as the performance of retrieval 
becomes better. 

B. Result 

The results of the performance evaluation using the test 
dataset in IIV-BI derived from the network models in IIV-AI are 
demonstrated. 

Let's start with the first class of the network models (real 
organization) and learn the implication of the method. Figj3] 
shows the precision (p), recall (r), and F measure (F) in 
the trial where the experimental condition is that the node 
ncsio in the model (A) is the target covert node to discover 



(C = {ncsio}, |C| = 1, N =\0\ = 106). The horizontal 
axis is the rate of the number of the retrieved data (D Y ) to 
the number of the whole data (D). The vertical solid line 
indicates the position at D r = D t . The broken lines indicate 
the theoretical limit (upper bound) and the random retrieval 
limit (lower bound). The evaluation is under the condition 
where the all possible communication patterns are known. 

The precision, recall, and F measure are the same value of 
0.78 at D r = D t . These are much better than those of the 
random retrieval (F(D t ) = 0.04) and close to the theoretical 
limit. The method fails to discover two suspicious records 
Si ={n C sio, ncsn}, and {n C sio, n C si2} when D r is small. 
This indicates that the communication with the nodes having 
small nodal degree (K(ncsu) = 1 and K(ncsi2) — 1) 
does not provide much clues for node discovery. On the other 
hand, the most suspicious observation data d a m includes all 
the neighbor nodes n C si, n C s2, n C s4, n C S5, n C se, n C S7, 
ncsii* an d ^csi2- The method succeeded in discovering most 
of the suspicious records and the all suspicious nodes. The 
investigators will decide to collect more detailed information 
on the communication (and a resulting collaborative activ- 
ity) of the suspicious neighbor nodes. This will result in 
identifying, locating, and finally, capturing the covert leader 
(C = {ncsio}) who is responsible for many terrorism attacks. 

Let's move on to the second class of the network model 
(mathematical model with adjustable parameters) and study 
the extensive performance characteristics of the method. Figj4] 
shows the F measure F(D t ) as a function of the nodal degree 
K. Individual plots shows the F measure averaged over the 
trials where the experimental condition is that a node having 
a given nodal degree K(rii) = K is the target covert node 
to discover (N = |0| = 200, \C\ = 1). The solid line 
graphs (a), (b), and (c) are for the model (B), (C), and (D). 
The broken lines indicate the theoretical limit and the random 
retrieval limit. The evaluation is under the condition where 
the all possible communication patterns are known in FigH 
through FigJSl The resulting F measure ranges from 0.7 to 1. 
It does not depend on the number of groups (or topology of 
the network model). The performance becomes better as the 
nodal degree of the target covert nodes increases. 

Figj5] shows the F measure F(D t ) as a function of the 
number of groups G in the trial where the largest hub is the 
target covert node to discover (N = \0\ = 200, |C| = 1). The 
horizontal axis is G/N. The number of the nodes is constant. 
The group contrast parameter is fixed at n(G — 1) = 400 
regardless of the value of G. The broken lines indicate the 
theoretical limit and the random retrieval limit. The F measure 
degrades down to 0.7 around G = O.bN. But the performance 
still remains much better than that of the random retrieval. The 
method can be applied for any value of G. 

Figj6] shows the F measure F(D t ) as a function of the 
number of overt nodes (N = |0|) in the trial where the 
largest hub is the target covert node to discover (|C| = 1). 
The number of the groups is constant (G = 1). The broken 
lines indicate the theoretical limit and the random retrieval 
limit. Except the case N = 50, the performance remains 
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Fig. 3. Precision (p), recall (r), and F measure (F) in the trial where the 
node ncsio in the model (A) is the target covert node to discover (C = 
{^CSio}, \C\ = 1, N = \0\ = 106). The horizontal axis is the rate of 
the number of the retrieved data (D T ) to the number of the whole data (D). 
The vertical solid line indicates the position at D r = Dt. The broken lines 
indicate the theoretical limit and the random retrieval limit. 
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Fig. 4. F measure F(Dt) as a function of the nodal degree K. Individual 
plots shows the F measure averaged over the trials where a node having a given 
nodal degree K{ni) = K is the target covert node to discover (|C| = 1). 
The solid line graphs (a), (b), and (c) are for the model (B), (C), and (D) 
(|0| = 200). The broken lines indicate the theoretical limit and the random 
retrieval limit. 
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Fig. 5. F measure F(Dt) as a function of the number of groups G in the 
trial where the largest hub is the target covert node to discover. The number 
of the nodes is constant (|0| = 200, |C| = 1). The group contrast parameter 
is r)(G — 1) = 400. The broken lines indicate the theoretical limit and the 
random retrieval limit. 
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Fig. 6. F measure F(Dt) as a function of the number of nodes N = \0\ in 
the trial where the largest hub is the target covert node to discover (|C| = 1). 
The number of the groups is constant (G = 1). The broken lines indicate the 
theoretical limit and the random retrieval limit. 



constant. The method can be applied for large networks. Note 
that several hours of calculation is necessary with a standard 
personal computer when N approaches to 1000. The size of 
the network is limited by the amount of calculation rather than 
by the accuracy obtainable from the method. 

Fig|7] shows the F measure F(D t ) as a function of the 
number of the observed data D in the trial where the node no in 
the model (B) is the target covert node to discover (C = {no}). 
The horizontal axis is the ratio of D to the number of the 
possible communication patterns (|OUC| = N+l) as assumed 
in HV-Bl The ratio was D/N = 1 in FigH through FigE 
The broken lines indicate the theoretical limit and the random 
retrieval limit. The F measure is close to the theoretical limit, 
if more than 80% of the possible communication patterns is 
observed. The performance is no better than that of the random 
retrieval if only 50% of the possible communication patterns 
is observed. It is a major restriction imposed on the method 
that many of the possible communication patterns need to be 
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Fig. 7. F measure F(D t ) as a function of the number of the observed data 
D in the trial where the node no in the model (B) is the target covert node to 
discover. The horizontal axis is D/N. The broken lines indicate the theoretical 
limit and the random retrieval limit. 



known. Overcoming the restriction is for future work. 

VI. Conclusion 

In this paper, I define a node discovery problem in a 
networked organization and present a method to solve the 
problem. The method infers the network behind the social 
interactions, applies an anomaly detection technique to the 
surveillance logs, and identifies the suspicious surveillance 
logs. The precision, recall, and F measure characteristics are 
close to the theoretical limit for any covert nodes in the 
networks of any topologies and sizes. I believe that, in the 
investigation of a clandestine organization lfT4ll . the method 
aids the investigators in identifying the close associates (par- 
ticipants in the most suspicious surveillance record) of a covert 
leader or a critical conspirator. 

I plan to address 3 issues for the future works. The first issue 
is to overcome the restriction where the performance degrades 
unless the ratio of the number of the observation to the number 
of possible communication patterns is large. The second issue 
is to extend the models for the social interactions. The model 
in this paper represents the radial influence transmission from 
an initiating node toward multiple responder nodes. In real 
networked organizations, other types of influence transmission 
are present such as serial (chain- shaped) influence transmis- 
sion, or tree-like influence transmission. The third issue is to 
develop a method to solve the variants of the node discovery 
problem. Discovering fake nodes, or spoofing nodes are also 
interesting problems to uncover the malicious intentions of the 
organization. A fake node is the person who does not exist in 
the organization, but appears in the surveillance. A spoofing 
node is the person who belong to an organization, but appears 
as a different node in the surveillance. 

We encounter the node discovery problem in many areas of 
business and social sciences ifHl . For example, in document 
analysis l23l . something unknown, which is not stated explic- 
itly, can be discovered. The discovery may provide the analyst 
with a clue to approach the hidden intention of the author, an 
opinion which is about to emerge, or a sign of trends. The 



method will be the new basis to analyze something hidden 
behind the direct observation, which is beyond the scope of the 
conventional statistical methods and data mining expertises. 

References 

[I] L. A. Adamic, R. M. Lukose, A. R. Puniyani, and B. Huberman, Search 
in power-law networks, Physical Review E vol. 64, 046135, 2001. 

[2] L. A. Adamic, and E. Adar, Friends and neighbors on the web, Social 

Networks vol. 25, pp. 211-228, 2003. 
[3] A. L. Barabasi, R. Albert, and H. Jeong, Mean-field theory for scale-free 

random networks, Physica A vol. 272, pp. 173-187, 1999. 
[4] M. Chau, and H. Chen, Incorporating web analysis into neural networks: 

an example in hopfield net searching, IEEE Transactions on Systems, Man, 

& Cybernetics Part C vol. 37, pp. 352-358, 2007. 
[5] A. Clauset, C. Moore, and M. E. J. Newman: Hierarchical structure and 

the prediction of missing links in networks, Nature vol. 453, pp. 98-100, 

2008. 

[6] P. Erdos, and A. Reny, On random graphs. L, Publicationes Mathematicae 

vol. 6, pp. 290-297, 1959. 
[7] L. Getoor, and C. P. Diehl, Link mining: a survey, ACM SIGKDD 

Explorations vol. 7, pp. 3-12, 2005. 
[8] T. Hastie, R. Tibshirani, and J. Friedman, The elements of statistical 

learning - Data mining, inference, and prediction. Springer- Verlag, 2001. 
[9] P. S. Keila, and D. B. Skillicorn, Structure in the Enron email dataset, 

Journal of Computational & Mathematical Organization Theory vol. 11, 

pp. 183-199, 2006. 
[10] R. R. Korfhuge, Information storage and retrieval. Wiley, 1997. 

[II] N. Lavrac, P. Ljubic, T. Urbancic, G. Papa, M. Jermol, and S. Bollhalter, 
Trust modeling for networked organizations using reputation and collabo- 
ration estimates, IEEE Transactions on Systems, Man, & Cybernetics Part 
C vol. 37, pp. 429-439, 2007. 

[12] D. Liben-Nowell, and J. Kleinberg, The link prediction problem for 
social networks, Journal of American Society of Information Science and 
Technology vol. 58, pp.1019-1031, 2007. 

[13] Y. Maeno, and Y. Ohsawa, Human-computer interactive annealing for 
discovering invisible dark events, IEEE Transactions on Industrial Elec- 
tronics vol. 54, pp. 1184-1192, 2007. 

[14] Y. Maeno, and Y. Ohsawa, Analyzing covert social network foundation 
behind terrorism disaster, International Journal of Services Sciences vol. 
2, pp. 125-141, 2009. 

[15] Y. Maeno, and Y. Ohsawa, Reflective visualization and verbalization of 
unconscious preference, in press, International Journal of Advanced Intel- 
ligence Paradigms, 2009. Available e-print http://arxiv.org/abs/0803.4074 

[16] M. E. J. Newman, and E. A. Leicht: Mixture models and exploratory 
analysis in networks, Proceedings of the National Academy of Sciences 
USA vol. 104, pp. 9564-9569, 2007. 

[17] G. Palla, I. Derenyi, I Farkas, and T. Vicsek: Uncovering the overlapping 
community structure of complex networks in nature and society, Nature 
vol. 435, pp. 814-818, 2005. 

[18] M. G. Rabbat, M. A. T. Figueiredo, and R. D. Nowak: Network Inference 
from co-occurrences, IEEE Transactions on Information Theory vol. 54, 
pp. 4053-4068, 2008. 

[19] M. Sageman, Understanding terror networks. University of Pennsylvania 
Press, 2004. 

[20] J. Silva, and R. Willett: Hypergraph-based anomaly detection of high- 
dimensional co-occurrences, IEEE Transactions on Pattern Analysis and 
Machine Intelligence vol. 31, pp. 563-569, 2009. 

[21] R. Silva, R. Schemes, C. Glymour, and P. Spirtes, Learning the structure 
of linear latent variable models, Journal of Machine Learning Research 
vol. 7, pp. 191-246, 2006. 

[22] S. Singh, J. Allanach, T. Haiying, K. Pattipati, and P. Willett, Stochastic 
modeling of a terrorist event via the AS AM system, in Proceedings of the 
IEEE International Conference on Systems, Man & Cybernetics, Hague, 
2004. 

[23] B. Taskar, M. F. Wong, P. Abbeel, and D. Koller, Link prediction in 
relational data, in Proceedings of the Neural Information Processing 
Systems Conference, Vancouver, 2003. 

[24] D. J. Watts, and S. H. Strogatz, Collective dynamics of small- world 
networks, Nature vol. 398, pp. 440-442, 1998. 

[25] A. Zakarian, A new nonbinary matrix clustering algorithm for devel- 
opment of system architectures, IEEE Transactions on Systems, Man, & 
Cybernetics Part C vol. 38, pp. 135-141, 2008. 



SMC 2009 



